From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 177E73E958E for ; Wed, 4 Feb 2026 11:10:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770203442; cv=none; b=glwm+2UwslNfXfDrZaPNr5hCEOrWufEDau9ayJlBS7FH2hR61seTaruziKrrMnDrsRVtHJVuv90fGTH7djeV72ZN5neS48Gkaoe/jyZROwzxfvtj/wYccIgdKAhK3C2F6cHlroIQJm3qbFh+5FZfLfIutpbqhb7Ozfb+HffHlMc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770203442; c=relaxed/simple; bh=ZKSgW0O+qa5eygGMy3SgZ5TmviiTwJ16vShc+eliAsc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=a+SSGNYHXXitquykw3NUciN6vc51vQyE/RCRImao4WxXt7OkpjeaKlS54eV1t+0eD9sd/g3oyWUwQJjmOuCs19cdjP38568hXc2sPLYKuNtRmMOPeQBrkcLGUgym/XyhWP3JvLIIwe+t9zDJRfcDt5of7Njtvhc9PHP8/Csnx/c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=tuIqt/R4; arc=none smtp.client-ip=209.85.128.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="tuIqt/R4" Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-483100e97d8so3887855e9.2 for ; Wed, 04 Feb 2026 03:10:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1770203440; x=1770808240; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=eIr1YulAlgobkWRt4PikUjH7ZPuHX71f9MLxBLtW45o=; b=tuIqt/R4/K7saEAfJtVzMu2Gv+fXSdWH5nARJBdBtGep3kp0rkxyoQ/U8cfzFisssH 9H0R2X7CZYEG5xtqynTo1KTNFo3/IcQK9NA0sNXNJ7HRcZydMRcrJpHMEfdHfVnsX4eX o5RtyeEkQWFRXFetWSUrVTm2zK9DDrWYQqIgu0+v39lxtebEhur6R7VzMLLgvuo6ZjIP FTEvqjG4kIxG7+Aq0wg2YubJb8CufV8o/BOaMcFNsSU92DuP5h5RLMVOaTKaPJiE5H2Y Tf71vBSQjjS3BQxFgmljvF+/sVdiVfkgRLLGl17v6HahE8+goD8JOGuXZnDCDM0afoqA Rq7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770203440; x=1770808240; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=eIr1YulAlgobkWRt4PikUjH7ZPuHX71f9MLxBLtW45o=; b=GRq6cCxg5R6XGKERB45JUvKmTgcTfzp8ijIdMVMXtzhwiAVeaA8vFUZBnzaxy/fCUA +/9vxQyNNT7JCGBVPOPYK+k3MTWi0tFufatCbboFYYu9vdngp6SWp0DAZIPmIyetxg3i nf8ohLQdgc0J5CC++VQMg0C/mggttJgz0FR2tXtP+V5b+aPzh6gldjP6X0u69Uob8TmS 1dWk9Cks1PTlWS1pznWgdMWHggliM78Da60G8oPCfE3nDjkSMqpLF2GLs0OBytHnPZXI dFZWj9wkA6J+OWqbs0xWzPH3R6qfmZmO+lH/3DvgEUivMTimOztrk95v0zHtX/Zh9ycu vuBg== X-Forwarded-Encrypted: i=1; AJvYcCUuL/7h4PRF8seRz/6Tz+Agq3GsaO8b2f+mizWRFl8XXSIfC1cv1idW+QYvxlSnvFRej1DPaDPCoSn4lO0=@vger.kernel.org X-Gm-Message-State: AOJu0YwMMt6tVMIrsDPp8x4WLae6sHAwtgeAd0AG8ZOg3Z+z/OXQGOz7 oD9tqjhd67cTRnSKTpS00wVqKfDYN29oM4TeEs1Boi3gYmElU/mSRoweKuyQQUWyWD8= X-Gm-Gg: AZuq6aJLzZSeQ8Tzq4DS0E4EYkdCYv3E9EJUUa50aSoCNf3VAWAL5jeypyj8uohImi0 IirrhZEHGCuDDeaha5i4FXalgkdyjFxFsUVEzUoXkiqYw5OxSFmtbQ94coCgAXoFr30OtwUEjY8 ZRb/rn7oJepMp4aGeSt96UmcUr5K7bGVTo7XsyiPoabNc3GNMrj4oDgq+Q6eoKwzUmkS7DHDTA5 U5amxqTGYCELNDW0+Y6Zhg8cEbRbLALUq88FdTzBKHAlCn4olOKzUZxR7qlrjNvxwKVf3Q+WosL 5qFZjDSx4xXM/P0uAfAra0SSCqY4f58gmTq39spSZry4O5IWS9XRBQylRVFYpCimCD+U4tS7Dxy 7h/sbLz6VWUBLbZZCt1UUtii64a83ovg+VcH/V16aPU+J/A97EEx+e1EU6L9fb0rqd5AWzPDnD9 xgevGi8AczlVJVYl5p X-Received: by 2002:a05:600c:4e0f:b0:482:f12f:f35e with SMTP id 5b1f17b1804b1-4830e9310f6mr32222825e9.12.1770203440211; Wed, 04 Feb 2026 03:10:40 -0800 (PST) Received: from localhost ([196.207.164.177]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4831084dd88sm37722245e9.6.2026.02.04.03.10.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Feb 2026 03:10:39 -0800 (PST) Date: Wed, 4 Feb 2026 14:10:36 +0300 From: Dan Carpenter To: Artem Lytkin Cc: Sudip Mukherjee , Teddy Wang , Greg Kroah-Hartman , linux-fbdev@vger.kernel.org, linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2 1/4] staging: sm750fb: add bounds checking to option parsing in lynxfb_setup() Message-ID: References: <20260204101536.3311-1-iprintercanon@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260204101536.3311-1-iprintercanon@gmail.com> On Wed, Feb 04, 2026 at 10:15:33AM +0000, Artem Lytkin wrote: > Replace strcat() with memcpy() and add explicit bounds checking on the > remaining buffer space before each copy. The original code lacked any > validation that the write position stays within the allocated buffer. > This implies that there is a buffer overflow. It's important to review this sort of thing and add a Fixes tag if the buffer overflow is real. In this case the code works ok as-is. My main problem with the original code is what you explained in the v1 commit, the strcat() was just doing a memcpy(). It wasn't concatenating two strings. Just resend the v1 patch with the following commit message: As part of kernel hardening, I am auditing calls to strcat(). This code works but it is a bit ugly. This function takes a string "options" and allocates "g_settings" which is large enough to hold a copy of "options". It copies all the options from "options" to "g_settings" except "noaccel", "nomtrr" and "dual". The new buffer is large enough to fit all the options so there is no buffer overflow in using strcat() here. However, using strcat() is misleading because "tmp" always points to the next unused character in the "g_settings" buffer and it's always the NUL character. Use memcpy() instead to make the code easier to read. This also removes an instance of strcat() which is a #NiceBonus. regards, dan carpenter